rails_kms_credentials 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 532e8e95ed3635abe5c43507b35822004aba639aa7e54c6288e2d7c67c206c9b
-  data.tar.gz: 30bd1527ede5fd129a31941a5252b98196ce1b12c997f10576c29c83ed583b9d
+  metadata.gz: c0273094dabd151a67eb56db4f3211b88264a2cce57ca9ab1877cffc7b4ad691
+  data.tar.gz: 151cdc9835b37d4d6207af37cec2ac926ec31165790e91d1d8ad8a4a93bff334
 SHA512:
-  metadata.gz: 9b76e471786e5ac4d9ab8e1017e23916fcd469f1144e5352e72d25e644cc9e646bd8e7823b7629254723f11c30a60fba819e402d1405079033e3f26338c6bbe1
-  data.tar.gz: 616d9251fb153f967579886457d0370651a17425e693cb31af31c9966f1bb9a88713036bf455ca120095b6ace6ad84f2f72b3d0457b13a253a654d3685a3873f
+  metadata.gz: 6957d12ad6e5d28458248dac4ccec8b49a568237d9fcdf954341b486e190d78febdee246ddf7b70371ec7c87d4883afc7edc282a44ed5e301ad7db0c735d9d2e
+  data.tar.gz: 38bebac72a46d229b0b000c559863d901f2b2be1dd3e0d4ce9de1c3ec73b4de39db976aa6bf4284e65a592c393e1ce90e8619ddcebd43ab440ca465e641d252b

data/lib/rails_kms_credentials/store/azure_key_vault/client/aks_workload_identity.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module RailsKmsCredentials
+  module Store
+    module AzureKeyVault
+      module Client
+        class AksWorkloadIdentity < Base
+          ENV_AUTHORITY_HOST = 'AZURE_AUTHORITY_HOST'
+          ENV_CLIENT_ID = 'AZURE_CLIENT_ID'
+          ENV_FEDERATED_TOKEN_FILE = 'AZURE_FEDERATED_TOKEN_FILE'
+          ENV_TENANT_ID = 'AZURE_TENANT_ID'
+
+          
+          attr_reader :authority_host, :client_id, :federated_token_file, :tenant_id
+
+          def initialize(*)
+            super
+            @authority_host = ENV[ENV_AUTHORITY_HOST]
+            raise 'Missing KmsCredentials AzureKeyVault AksWorkloadIdentity authority_host' if authority_host.blank?
+            @client_id = ENV[ENV_CLIENT_ID]
+            raise 'Missing KmsCredentials AzureKeyVault AksWorkloadIdentity client_id' if @client_id.blank?
+            @federated_token_file = ENV[ENV_FEDERATED_TOKEN_FILE]
+            raise 'Missing KmsCredentials AzureKeyVault AksWorkloadIdentity federated_token_file' if @federated_token_file.blank?
+            raise "Missing KmsCredentials AzureKeyVault AksWorkloadIdentity federated_token_file does not exist: `#{@federated_token_file}`" unless File.exist?(@federated_token_file)
+            @tenant_id = ENV[ENV_TENANT_ID]
+            raise 'Missing KmsCredentials AzureKeyVault AksWorkloadIdentity tenant_id' if @tenant_id.blank?
+          end
+
+          def get_secrets_list(url)
+            HTTParty.get(
+              url,
+              headers: {
+                Authorization: "Bearer #{access_token}",
+              },
+            )
+          end
+
+          def get_secret(url)
+            HTTParty.get(
+              url,
+              headers: {
+                Authorization: "Bearer #{access_token}",
+              },
+            )
+          end
+
+          private
+
+            def client_secret
+              @client_secret ||= File.read(@federated_token_file)
+            end
+
+            def access_token
+              return @access_token if instance_variable_defined?(:@access_token)
+              @_access_token_response = HTTParty.post(
+                "#{authority_host}/#{tenant_id}/oauth2/v2.0/token",
+                {
+                  body: {
+                    client_id: client_id,
+                    client_secret: client_secret,
+                    scope: 'https://vault.azure.net/.default',
+                    grant_type: 'client_credentials',
+                  }
+                }
+              )
+              raise 'KmsCredentials AzureKeyVault AksWorkloadIdentity unable to get access token' unless @_access_token_response.ok?
+              @access_token = @_access_token_response['access_token']
+            end
+
+        end
+
+        add(:aks_workload_identity, AksWorkloadIdentity)
+
+      end
+    end
+  end
+end

data/lib/rails_kms_credentials/store/azure_key_vault/client.rb

@@ -25,5 +25,6 @@ module RailsKmsCredentials
 end
 
 require 'rails_kms_credentials/store/azure_key_vault/client/base'
+require 'rails_kms_credentials/store/azure_key_vault/client/aks_workload_identity'
 require 'rails_kms_credentials/store/azure_key_vault/client/client_credentials'
 require 'rails_kms_credentials/store/azure_key_vault/client/managed_identity'

data/lib/rails_kms_credentials/version.rb

@@ -4,8 +4,8 @@ module RailsKmsCredentials
 
   module Version
     MAJOR = 0
-    MINOR = 2
-    PATCH = 1
+    MINOR = 3
+    PATCH = 0
 
   end
 

data/rails_kms_credentials.gemspec

@@ -30,5 +30,5 @@ Gem::Specification.new do |s|
   s.add_dependency('activesupport', '>= 5.0.0')
   s.add_dependency('railties', '>= 5.0.0')
 
-  s.add_dependency('httparty', '~> 0.17.0')
+  s.add_dependency('httparty', '~> 0.21.0')
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_kms_credentials
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Taylor Yelverton
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-18 00:00:00.000000000 Z
+date: 2023-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.17.0
+        version: 0.21.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.17.0
+        version: 0.21.0
 description: Add support for different credentials for different kmss to Rails
 email: rubygems@yelvert.io
 executables: []
@@ -67,6 +67,7 @@ files:
 - lib/rails_kms_credentials/store.rb
 - lib/rails_kms_credentials/store/azure_key_vault.rb
 - lib/rails_kms_credentials/store/azure_key_vault/client.rb
+- lib/rails_kms_credentials/store/azure_key_vault/client/aks_workload_identity.rb
 - lib/rails_kms_credentials/store/azure_key_vault/client/base.rb
 - lib/rails_kms_credentials/store/azure_key_vault/client/client_credentials.rb
 - lib/rails_kms_credentials/store/azure_key_vault/client/managed_identity.rb